Add CI/CD with GoReleaser, Multi-arch Docker, SBOM and Cosign Signing

[bupd]

Summary

• Optimize Dockerfile with multi-stage build using Bun instead of Node.js (~60% smaller image)
• Add GoReleaser for automated multi-platform binary releases with SBOM generation
• Add CI workflow for docker builds on push to main
• Add release workflow triggered on version tags
• Sign all docker images with cosign keyless signing via Sigstore
• Copy images to Harbor registry with signing

Docker Images

• Multi-arch: linux/amd64, linux/arm64
• SBOM and provenance attestations
• Published to ghcr.io/bupd/shitpost
• Mirrored to registry.goharbor.io/bupd/shitpost
• Signed with cosign (keyless)

Binaries (on release)

• linux/amd64, linux/arm64
• darwin/amd64, darwin/arm64
• windows/amd64, windows/arm64
• SBOM generated via syft

Workflows

• CI: Build, test, push docker to GHCR and Harbor on push to main
• Release: GoReleaser + docker build on version tags

Required Secrets

• HARBOR_USERNAME
• HARBOR_PASSWORD